Enterprise AI governance
Govern model traffic, attribute spend, enforce policy, and preserve audit evidence across every AI interaction in your organization.
Products in this solution
Problem
Generative AI moved from experiment to production inside your organization before anyone wrote a governance policy. Today you have multiple model providers, internal copilots, custom agents, growing bills, and security teams asking for evidence you cannot produce. EU AI Act enforcement can reach the higher of EUR 35M or 7% of global annual turnover (Article 99), and a single AI-generated destructive action has no insurance coverage.
Stakeholders
CISO and security teams need immutable evidence of AI usage. AI platform engineering needs a single ingress with policy and budget controls. FinOps and tech leadership need per-team cost attribution. Compliance and risk need audit trails aligned with EU AI Act readiness.
Architecture
Gateway terminates Chrysent and client authentication and never forwards either upstream. It authenticates the request and pins a Gateway component snapshot before any provider call. If Touchstone is configured for input inspection, the request content is forwarded with expected-compatibility context, classified, and returned with a decision and snapshot version. Gateway then injects the route-resolved provider credential after final destination validation, forwards client headers to the provider by default with only narrow hop-by-hop, credential, framing, and proxy-chain exclusions, and routes to an enrolled endpoint. Native streaming frames are forwarded without buffering. Outcomes, native usage, version set, and provenance are recorded to the Evidence Plane. Customer-supplied provider credentials (BYOK) are isolated from Chrysent internal credentials. Configuration hot-reloads without mutating in-flight work — ordinary invalid configuration leaves the previous valid snapshot active. Every interaction records the complete version set used across Gateway, Touchstone, and the Evidence Plane.
Outcomes
Cost attributed at the unit that matters; budget controls and circuit breakers wired into the request path; policy enforced per tenant; audit-grade session ledger with replay; PII redacted before egress; configurable retention modes per tenant.
Proof
See /benchmarks for the published and in-preparation studies. The first two studies cover Gateway latency overhead and Touchstone detection quality. Design partners receive a private run report under NDA during the preview window.
Deployment
Chrysent sells self-hosted software only. Gateway and Touchstone run in customer-owned or customer-controlled infrastructure, and retained product data remains there. Customer-configured external model providers receive provider-bound request data under the customer's provider agreement. This model supports data sovereignty and residency requirements. Air-gap-capable deployment is a future direction.
FAQs
See Gateway and Touchstone product pages for product-level FAQs. This page describes the governance story; the product pages describe the products.